Xen contains a flaw that may allow a local denial of service. The issue is triggered due to the backend drivers leaking references to kernel threads, which when exploited by a malicious guest can prevent a proper virtual shutdown, prevent 'xm' commands from functioning properly, and may result in loss of availability for the service.

Currently, there are no known workarounds or upgrades to correct this issue. However, XEN has committed a source code patch to its repository to address this vulnerability.

• Security Tracker: 1024786
• CVE ID: 2010-3699 (see also: NVD)
• Secunia Advisory ID: 42372 42789 43056 43127 43480 43639 43762 44190 44376 46397
• Bugtraq ID: 45039
• VUPEN Advisory: ADV-2011-0024 ADV-2011-0213
• Vendor Specific News/Changelog Entry: http://lists.debian.org/debian-security-announce/2011/msg00017.html
  http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00007.html
  http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00003.html
  http://www.vmware.com/security/advisories/VMSA-2011-0012.html
  http://xenbits.xensource.com/linux-2.6.18-xen.hg?rev/59f097ef181b
  https://hermes.opensuse.org/messages/7561275
  https://lists.ubuntu.com/archives/ubuntu-security-announce/2011-February/001256.html
• Vendor Specific Advisory URL: http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00007.html
  http://lists.opensuse.org/opensuse-updates/2011-04/msg00074.html
  https://hermes.opensuse.org/messages/8086845
• Other Advisory URL: http://wiki.openvz.org/Download/kernel/rhel5/028stab085.2
• RedHat RHSA: RHSA-2011:0004

• Not Available